Filters

Filters are javascript functions that allow you to modify event data or control the flow of an event through the system.

The main reason this project exists was to provide users a "real" scripting language to use when working with event
data. If you have ever tried using logstash you may have gotten irritated with trying to do anything more than basic
data manipulation, this is mainly because you were working in almost ruby but not quite.

Every event will contain the following properties in the data object:

source: The input plugin that generated the event.

message: The event message.

timestamp: The time the event occurred or was received by the input plugin.

A simple filter example:

addFilter(function (event) {
// Add a gotHere property to the event data
event.data.gotHere = 'Yay!'
// Allow the event to progress to the next filter or on to output plugins
event.next()
})

A little more advanced, this one is named:

addFilter('cool', function (event) {
// Drop all events with a 'stupid event' message, these events will never see an output plugin
if (event.data.message == 'stupid event') {
// Be sure to return anytime you may continue processing the event to avoid weird issues
return event.cancel()
}
// Have any events with a 'high priority' message skip any other filters and go directly to output plugins
if (event.data.message == 'high priority') {
return event.complete()
}
// All other events get here
event.data.superAwesome = 'sure is'
// Want to rename a field to have a crazy character?
event.data['@message'] = event.data.message
delete event.data.message
// Since this is the last thing in the filter there is no need to return
event.next()
})

Filters get an integer name by default. If you want better error and telemetry reporting, give them a name.

Remember, this is all pure Node.js. You can do any crazy exotic thing you want. Just remember that the more you do the
slower each event is processed.

Outputs

Outputs are exactly what they sound like. The output an event to a place.